Browse CVEs

HIGH 7.5 CVE-2026-9740 A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted m… MongoDB 7.0.35 / 8.0.24+ Fix from $1,9502026-06-09 MEDIUM 6.5 CVE-2026-9741 A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE)… MongoDB 7.0.35 / 8.0.24+ Fix from $1,6002026-06-09 MEDIUM 6.5 CVE-2026-9743 In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequentl… MongoDB 8.0.24+ Fix from $1,6002026-06-09 MEDIUM 6.5 CVE-2026-9746 When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. … MongoDB 7.0.35 / 8.0.24+ Fix from $1,6002026-06-09 MEDIUM 5.9 CVE-2026-9742 When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that… MongoDB 8.2.10 / 8.3.3+ Fix from $1,6002026-06-09 MEDIUM 5.5 CVE-2026-9735 MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric … MongoDB 8.3.3+ Fix from $1,6002026-06-09 MEDIUM 6.5 CVE-2026-8202 Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user w… MongoDB 7.0.34 / 8.0.23+ Fix from $1,6002026-05-13 MEDIUM 6.5 CVE-2026-8336 After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authentica… MongoDB 8.2.9 / 8.3.2+ Fix from $1,6002026-05-13 HIGH 8.8 CVE-2026-8053 An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-b… MongoDB 5.0.33 / 6.0.28+ Fix from $1,9502026-05-13 HIGH 8.8 CVE-2026-8201 A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd a… MongoDB 7.0.34 / 8.0.23+ Fix from $1,9502026-05-13 MEDIUM 6.5 CVE-2026-8199 An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bits… MongoDB 7.0.34 / 8.0.23+ Fix from $1,6002026-05-13 MEDIUM 5.3 CVE-2026-8200 When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generat… MongoDB 7.0.34 / 8.0.23+ Fix from $1,6002026-05-13 MEDIUM 6.5 CVE-2026-8063 An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server … MongoDB 8.2.7+ Fix from $1,6002026-05-07 HIGH 7.8 CVE-2026-6691 The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before… C Driver 2.1.2+ Fix from $1,9502026-05-06 HIGH 7.5 CVE-2026-6914 Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects … MongoDB 7.0.32 / 8.0.21+ Fix from $1,9502026-04-29 HIGH 7.5 CVE-2026-6231 The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for … C Driver 1.30.5 / 2.0.2+ Fix from $1,9502026-04-13 MEDIUM 5.3 CVE-2026-5170 A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictabl… MongoDB 7.0.31 / 8.0.18+ Fix from $1,6002026-03-30 HIGH 7.5 CVE-2026-4358 A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory is… MongoDB 7.0.31 / 8.0.20+ Fix from $1,9502026-03-17 HIGH 8.8 CVE-2026-4148 A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $looku… MongoDB 7.0.31 / 8.0.20+ Fix from $1,9502026-03-17 MEDIUM 6.5 CVE-2026-25610 An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. MongoDB 7.0.29 / 8.0.13+ Fix from $1,6002026-02-10 MEDIUM 6.5 CVE-2026-25613 An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. MongoDB 7.0.29 / 8.0.18+ Fix from $1,6002026-02-10 HIGH 7.5 CVE-2026-1847 Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This c… MongoDB 7.0.29 / 8.0.18+ Fix from $1,9502026-02-10 HIGH 7.5 CVE-2026-1848 Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connect… MongoDB 7.0.29 / 8.0.18+ Fix from $1,9502026-02-10 HIGH 7.5 CVE-2026-1849 MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursi… MongoDB 7.0.29 / 8.0.18+ Fix from $1,9502026-02-10 HIGH 7.5 CVE-2026-1850 Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. MongoDB 8.0.18 / 8.2.4+ Fix from $1,9502026-02-10 HIGH 7.5 CVE-2025-14847 KEVEPSS 83% Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue a… MongoDB 4.4.30 / 5.0.32+ Fix from $1,9502025-12-19 MEDIUM 5.4 CVE-2025-14345 A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inco… MongoDB 7.0.26 / 8.0.16+ Fix from $1,6002025-12-09 HIGH 7.5 CVE-2025-13644 MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistake… MongoDB 7.0.26 / 8.0.13+ Fix from $1,9502025-11-25 MEDIUM 6.5 CVE-2025-13643 A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. Th… MongoDB 7.0.26 / 8.0.14+ Fix from $1,6002025-11-25 MEDIUM 6.5 CVE-2025-13507 Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert f… MongoDB 7.0.26 / 8.0.16+ Fix from $1,6002025-11-25